MysqliEscapedValueSurvivesCharsetChange

warning native on by default

Group: Probable bugs

Identify query SQL containing unchanged real_escape_string output after set_charset on same mysqli connection to a proven different charset. Require known charset before escaping and successful charset change; unknown changes exclude.

Detection

• Report query SQL containing unchanged real_escape_string output after set_charset on same mysqli connection to a proven different charset. Require known charset before escaping and successful charset change; unknown changes exclude.
• Only the last set_charset call written on that connection decides each side. Before escaping, it must be the last call ahead of the real_escape_string call, execute on every path (or be checked for success) and name a constant charset. Before the query, the last call written between the escape and the query must be checked for success on the path to the query and name a constant charset that differs, ignoring letter case, from the escaping charset. set_charset calls on other connections are ignored.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values, escaped aliases or exhausted analysis budgets invalidate proof.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• No report when the charset is switched and then switched back to the escaping charset before the query, nor when the last set_charset call before the query (or before the escape) is conditional, unchecked or names an unknown charset: an earlier proven change no longer describes the connection at the query.
• Both @custos-ignore MysqliEscapedValueSurvivesCharsetChange and @noinspection MysqliEscapedValueSurvivesCharsetChange suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Available in PHP 5.3–8.5 where the referenced API exists. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "MysqliEscapedValueSurvivesCharsetChange": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore MysqliEscapedValueSurvivesCharsetChange